The 4C Entity licenses a different set of S-boxes for each application (such as DVD-Audio, DVD-Video and CPRM).[2]

Cryptanalysis

In 2008, an attack was published against a reduced 8-round version of Cryptomeria to discover the S-box in a chosen-key scenario. In a practical experiment, the attack succeeded in recovering parts of the S-box in 15 hours of CPU time, using 2 plaintext-ciphertext pairs.[2]

A paper by Julia Borghoff, Lars Knudsen, Gregor Leander and Krystian Matusiewicz in 2009 breaks the full-round cipher in three different scenarios; it presents a 224 time complexity attack to recover the S-box in a chosen-key scenario, a 248boomerang attack to recover the key with a known S-box using 244 adaptively chosen plaintexts/ciphertexts, and a 253.5 attack when both the key and S-box are unknown.[1]

Distributed brute force cracking effort

Following an announcement by Japanese HDTV broadcasters that they would start broadcasting programs with the copy-once broadcast flag starting with 2004-04-05, a distributed Cryptomeria cipher brute force cracking effort was launched on 2003-12-21. To enforce the broadcast flag, digital video recorders employ CPRM-compatible storage devices, which the project aimed to circumvent. However, the project was ended and declared a failure on 2004-03-08 after searching the entire 56-bit keyspace, failing to turn up a valid key for unknown reasons.[3]
Because the attack was based on S-box values from DVD-Audio, it was suggested that CPRM may use different S-boxes.[4]

Another brute force attack to recover DVD-AudioCPPM device keys was mounted on 2009-05-06. The attack was intended to find any of 24570 secret device keys by testing MKB file from Queen "The Game" DVD-Audio disc. On 2009-10-20 such key for column 0 and row 24408 was discovered.

The similar brute force attack to recover DVD-VRCPRM device keys was mounted on 2009-10-20. The attack was intended to find any of 3066 secret device keys by testing MKB from Panasonic LM-AF120LE DVD-RAM disc. On 2009-11-27 such key for column 0 and row 2630 was discovered.